@agentvault/agentvault@0.23.40
The official **OpenClaw** plugin for AgentVault. Adds cryptographic identity, earned trust, and Signal-grade encrypted communications to OpenClaw agents. (Looking for a different framework? See **[Which Framework?](#which-framework)** below.)
AI Security Review
scanned 2mo ago · by lpm-firewall-aiNo automatic lifecycle attack or unrelated exfiltration was found, so blocking as malware is not supported. The explicit setup and runtime extension nevertheless create a dangerous agent-control and telemetry capability that warrants a warning.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
A user runs agentvault setup with an invite token, then OpenClaw loads the configured extension.
Impact
A compromised or over-privileged AgentVault channel could direct the host agent; telemetry can disclose URLs, including sensitive query strings, to the configured service.
Mechanism
OpenClaw configuration and persistence setup plus runtime telemetry and authorized-message bridging.
AI rationale
No automatic lifecycle attack or unrelated exfiltration was found, so blocking as malware is not supported. The explicit setup and runtime extension nevertheless create a dangerous agent-control and telemetry capability that warrants a warning.
Evidence
dist/cli.jsdist/openclaw-entry.js~/.openclaw/openclaw.json~/.openclaw/agentvault
Network endpoints1
api.agentvault.chat
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The explicit setup command installs and allow-lists an OpenClaw plugin, then writes channel settings through shell commands.
- Setup registers the OpenClaw gateway with pm2 and enables boot-time restart persistence.
- The loaded extension intercepts global HTTP activity and reports complete request URLs to its telemetry channel.
- Inbound AgentVault messages are marked command-authorized before being dispatched to the host agent.
Evidence against
- package.json has no npm preinstall, install, or postinstall hook.
- The installation, configuration, and persistence actions require an explicit setup command and invite token.
- The observed network service is the package's own AgentVault API; no unrelated exfiltration endpoint or self-dependency was found.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStrings
Source & flagged code
11 flaggeddist/cli.jsView file
96Source sends the broad process environment to a literal external destination.
L96: // ../../node_modules/libsodium-sumo/dist/modules-sumo-esm/libsodium-sumo.mjs
L97: var __filename, __dirname, url2, path, Module, Module, root, window_, crypto_, randomValuesStandard, crypto4, randomValueNodeJS, _Module, libsodium_sumo_default;
L98: var init_libsodium_sumo = __esm({
...
L173: _Module = Module;
L174: Module.ready = new Promise(function(resolve4, reject) {
L175: var Module2 = _Module;
...
L244: quit_2 = (status, toThrow) => {
L245: process.exitCode = status;
L246: throw toThrow;
...
L258: xhr.responseType = "arraybuffer";
L259: xhr.send(null);
L260: return new Uint8Array(xhr.response);
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/cli.jsView on unpkg · L96•matchType = previous_version_dangerous_delta
matchedPackage = @agentvault/agentvault@0.23.35
matchedIdentity = npm:QGFnZW50dmF1bHQvYWdlbnR2YXVsdA:0.23.35
similarity = 0.500
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/cli.jsView on unpkgFindings
2 Critical7 High6 Medium5 Low
CriticalHardcoded Runtime Data Exfiltrationdist/cli.js
CriticalPrevious Version Dangerous Deltadist/cli.js
HighChild Processdist/cli.js
HighShell
HighSame File Env Network Executiondist/cli.js
HighCredential Redirect Persistencedist/index.js
HighCommand Output Exfiltrationdist/cli.js
HighCross File Remote Execution Contextdist/cli.js
HighSemantic Analysis Limiteddist/cli.js
MediumDynamic Requiredist/openclaw-entry.js
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/index.js
Affected versions and remediation
This report applies to @agentvault/agentvault@0.23.40.
See all versions of @agentvault/agentvault for other recorded verdicts.
- Review the evidence and your use of @agentvault/agentvault@0.23.40 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.